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Abstract. We propose an efficient four-intensity decoy-state BB84 protocol and derive concise security 
bounds for this protocol with the universally composable finite-key analysis method. Comparing with the 
efficient three-intensity protocol, we find that our efficient four-intensity protocol can increase the secret key 
rate by at least 30%. Particularly, this increasing rate of secret key rate will be raised as the transmission 
distance increases. At a large transmission distance, our efficient four-intensity protocol can improve the 
performance of quantum key distribution profoundly. 

PACS. 03.67.Dd Quantum cryptography and communication security - 03.67.Hk Quantum communica¬ 
tion 


1 Introduction 

Combining with one time pad [T], quantum key distribu¬ 
tion (QKD) [2j|3] can offer a private communication with 
an information-theoretical security [HOIHIII]. In practical 
QKD implementations, a weak pulsed laser source is uti¬ 
lized in place of an ideal single-photon source. To deal 
with the security vulnerability coming from the multi¬ 
photon components of emitted laser pulses [8l|9], decoy- 
state method is proposed [iniiiiKS]. With this method, 
the secure single-photon contribution can be estimated ef¬ 
fectively. 

In asymptotic setting (with infinitely long keys), the 
security of decoy-state QKD is analyzed [mill]. In the 
case of finite-length keys, security bounds against general 
attacks are first derived in Ref. m- Subsequently, Ref. 
m derives concise and tight finite-key security bounds 
for efficient three-intensity decoy-state protocol by com¬ 
bining the recent security proof technique with a 

hnite-key analysis for decoy-state method. The simulation 
results show that these bounds are relatively tight. 

Four-intensity decoy-state protocols are researched in 
[TTIITSIIT^I^ . However, in their works, the four different 
intensities are mainly used to obtain a tighter estimation 
formula for single-photon error rate mm and the se¬ 
cret key rates are calculated in asymptotic setting. For 
practical QKD implementations, the effects due to finite- 
length keys should be considered, e.g., statistical fluctua¬ 
tion [nmni]. Thus, in finite-key setting, statistical fluc¬ 
tuations of four different measurement values (the num¬ 
bers of quantum bit errors) should be taken into account 
when four intensities are all utilized for one estimation 
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formula of single-photon error rate mm, which may in 
contrary bring a lower secret key rate especially when the 
transmission distance is large. 

Here, we propose an efficient four-intensity decoy-state 
QKD protocol with biased basis choice. Unlike previous 
four-intensity protocols, in this protocol, the basis choice 
is biased and the estimation method for single-photon con¬ 
tribution is the same with the widely used one [Hill]. Ad¬ 
ditionally, different from efficient three-intensity protocols 
mmm, the intensities and the bases in our protocol 
are independent except the lowest intensity. More specif¬ 
ically, in our protocol, Z basis is used for key generation 
where three different intensities are utilized, and X ba¬ 
sis is used for testing where two different intensities are 
used [25j. The two higher intensities in Z basis (except 
lowest intensity) are independent from the higher inten¬ 
sity in X basis. Compared with efficient three-intensity 
protocols, the intensities in our protocol can be freely op¬ 
timized to increase the detected pulses in two bases (for a 
fixed number of sent pulses N) and decrease the statistical 
deviations caused by finite-length key. 

Using the universally composable finite-key analysis 
method m, we derive concise security bounds for our ef¬ 
ficient four-intensity protocol. With these bounds and sys¬ 
tem parameters in Ref. m, we perform some numerical 
simulations with full parameter optimization. When the 
number of sent pulses N is 10®, compared with efficient 
three-intensity protocol m, our protocol can increase the 
secret key rate by at least 30%. Particularly, this increas¬ 
ing rate of secret key rate will be raised with the increasing 
transmission distance. 
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2 Protocol description 

In this paper, we consider the efficient BB84 protocol [25] . 

i.e., the basis choice is biased. Our protocol is based on the 
transmission of phase-randomized laser pulses, and uses 
four different-intensity setting. Then, we describe our ef¬ 
ficient four-intensity protocol in detail. 

1. Preparation and measurement. Alice sends four dif¬ 

ferent kinds of weak laser pulses with intensities w, wi, U 2 , M 
{pL > vi -\- Lu^vi > Lo > Q,V 2 > uj > 0), with probabilities, 
Puj^ and P^ {.Puj Pvi ^u — respec¬ 

tively. Specially, the pulses with intensities (ui and /r) are 
all prepared in Z basis, the pulses with intensity V 2 are 
all prepared in X basis, and the pulses with the lowest 
intensity oj are prepared in Z{X) basis with probability 
Pz\uj{Px\uj) {Pz\uj + Px\uj = !)■ Bob chooses Z{X) ba¬ 
sis to perform the measurement with probability Pz{Px) 
[Pz + Px = !)■ 

2. Basis reconciliation and parameter estimation. Al¬ 

ice and Bob announce their basis choices over an authen¬ 
ticated public channel, and accomplish the sifting by re¬ 
serving the detected signals with the same basis and dis¬ 
carding the others. After this procedure, Alice and Bob 
share two bit strings with lengths nz and nx correspond¬ 
ing to two bases. Then, Alice announces the intensity in¬ 
formation. Based on that, the shared bit string in Z basis 
can be divided into three substrings with lengths, nz,v 
{v € {^,r;i,a;}), where nz = n-z,u- As for X ba- 

sis, Alice and Bob need to announce their bit strings. They 
compare them and obtain the numbers of bit error, mx,k 
{k € {v 2 ^io'\). With these nz,v and mx,k, they can calcu¬ 
late the number of vacuum events sz,o [Eq. ([2])], the num¬ 
ber of single-photon events sz,i [Eq. (|3])] and the phase er¬ 
ror rate ef ^ [Eq. ([5])] associated with single-photon events 
in Z basis. 

3. Error correction and privacy amplification. In the 
error-correction step, we assume that the error rate Ez is 
predetermined and at most \ec = fnzH{Ez) is revealed, 
where / is error-correction efficiency; H{x) = —a:log 2 {a;) — 
(1 — a;)log 2 (l — x) is the binary Shannon entropy func¬ 
tion. Next, an error verification is performed to ensure 
that Alice and Bob share a pair of identical keys. Scor is 
the probability that a pair of nonidentical keys pass this 
error-verification step. Finally, they perform the privacy 
amplification to extract the Esec-secret keys with length I 

[Eq.m- 


3 Security bounds for efficient four-intensity 
protocol 

Following the finite-key security analysis in Ref. m, the 
length of £sec-secret key I is given by 

1= [sz.o + sz,i[^ — H{ef^)] 

-A£;c-6l0g2^-l0g2j^J. (1) 

Then the secret key rate R is l/N, where N is the num¬ 
ber of pulses sent by Alice. sz,o sz,i and ef'^ are, re¬ 
spectively, the number of vacuum events, the number of 


single-photon events and the phase error rate associated 
with single-photon events in Z basis. The values of these 
three parameters need to be estimated with decoy-state 
method instead of being measured from the experiment 
directly. The estimation formulas of sz,o, sz,i and ef'^ 
are the same with the ones in Ref. [Tl] . 

It should be noted that the estimation of the number 
of single-photon events in X basis sx,i in our protocol is 
different from the one in Ref. [14]. From Eq.®, one can 
see that in order to accomplish the calculation of ef'^, 
sx.i needs to be estimated first. In Ref. sx,i is esti¬ 
mated by using Eqs. (ED and m with statistics from the 
X basis. Thus, the bounds n'^.^^, n'^ ^ and 

fj. should be estimated from the measurement values 
of nx.ai, nx,vi and nx,^ in X basis, which leads to 5 er¬ 
ror terms El- Different from the protocol in [Tl], only 
two intensities are used in X basis in our protocol. Here, 
we assume that the yields of single-photon state in two 
bases are equal in asymptotic setting. Then, in finite- 
key setting, sx,i can be estimated from sz,i by using the 
random-sampling theory (without replacement) [26] and 
the result is shown in Eq. I®. In this case, only 1 error 
term arises when is estimated. 

Such a change of the estimation method of sx.i causes 
a minor modification on the secret key rate formula [Eq. 
([ID]. According to the Eq. (B4) in Ref. [2], 21 error terms 
emerge during the secrecy analysis for the efficient three- 
intensity protocol, where 5 error terms come from the es¬ 
timation of sx,i. In our protocol, sx,i is estimated with 
sz,i, where 1 error term needs to be taken into considera¬ 
tion. Therefore, only 17 error terms need to be composed 
into the secrecy parameter Sgec when we apply the same 
secrecy analysis method in m to our protocol. Then, we 
set each error term to a common value and this value 
is used in both our secret key rate formula [Eq. ([ID] and 
finite-size decoy-state analysis [Eqs. (3, 5, 7, 8)J. Next, 
we will show how to estimate sz,o, sz,i and e^ in our 
protocol. 

szfl is given by 


SZfi > Tz,0 


Vi — UJ 


( 2 ) 


where Tz,i = PkPz\k^ /i] is the probability 

,a;} 

that Alice sends an i-photon pulse in Z basis, Pk and 
Pw\k are the probability to choose intensity k and the 
conditional probability to choose W basis {W S {Z,X}) 
conditional on k, and 


sz,i can be calculated by 

^ This is normally satisfied when all the detectors have the 
same parameters (dark count rate, detection efficiency and 
after-pulse probability) and are operating according to spec¬ 
ification. 
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SZA > 






^i(vi — oj) — vl 


■ (4) 


By using a random sampling without replacement |26j , 
sjf.i can be obtained by 

- 2iVf 5(iVf ,iVf, ^), (5) 

where = Ntw,iPw, C{x,y,z) = ~ 

1 _ 1 t 

12yz+l 12y(l-z) + lh_ 

/ \ 2(x-\-y)z(l — z) 1 \/x-\-yC(x,y,z) 

qix, y, z.e) = J ——- - log , ^ \ j _ 

^ Y ^ y/27rxyz(l-z)e 

The number of bit errors t;x,i associated with the single¬ 
photon events in X basis is given by 


vxA <txa 


'^X,V2 - 
{V2 - W) 


( 6 ) 


where txa = Y. PkPx\ke mx = mx,v 2 + mx,u, 

k£{v2 ,cj} 


m%k p p 


■ [mx^k ± 




e\ is computed by 


^In—],/c e {r; 2 ,w}. (7) 

^ ^ SftC, 


pz Cz,l . Vx,l . (Ssec Vx,l . .q. 

where 7 ( 0 , b, c, d) = ^ * log, ( X-Sid- )■ 


4 Numerical simulation 

To make a comparison with the efficient three-intensity 
protocol, we perform some numerical simulations for the 
fiber-based QKD system with the system parameters in 
m. shown in Table [1] These parameters come from re¬ 
cent decoy-state QKD and single-photon detector exper¬ 
iments mm- More specifically, the intensity of weakest 
decoy state uj = 2 x 10 “^ and the misalignment error 
rate Cmis = 5 x 10“^ are all from the experiment work 
in |27] . Bob uses an active measurement setup with two 
single-photon detectors and they have a detection effi¬ 
ciency rjB = 0 . 1 , a dark count rate pdc = 6 x 10 “^^, and an 
after-pulse probability pap = 0.04 [28]. The dedicated op¬ 
tical fiber is used for quantum channel and the attenuation 
coefficient of the fibers is 0.2 dB/km. For simulation, Ez is 
set to be the average of the observed error rates in Z basis 
and the error-correction efficiency / is set to be 1.16. In 
practice, the cost of error correction Xec is the size of the 
information exchanged during the error correction step. 
Regarding the secrecy, we also set Esec to be proportional 
to the key length I, that is, Esec = where At is a security 
constant and can be seen as the secrecy leakage per bit in 
final key. To reduce the optimization complexity, we set 


Table 1. List of parameters for numerical simulations, pdc 
is the dark count rate; Pap is the after-pulse probability; to 
is the lowest intensity; k is the security constant; Scor is the 
probability that shared secret keys are nonidentical; Cmis is the 
misalignment error rate; ps is the detection efficiency. 


Pdc 

Pap OJ K 

^cor ^mis pB 

6 X 10"'^ 

0.04 2 X lO""* 10"^® 

10"^® 5 X 10“® 0.1 

Table 2. 

Comparison of parameters 

at 100 km (standard 


fiber) between efficient three-intensity protocol |14| and our ef¬ 
ficient four-intensity protocol. More general comparison results 
are shown in Fig.[T] The second and third columns are, respec¬ 
tively, optimal parameters for efficient three-intensity proto¬ 
col and efficient four-intensity protocol. Compared with the 
efficient three-intensity protocol at 100 km, our efficient four- 
intensity protocol can increase key rate by 60%. 


Parameters 

Efficient 
three-intensity 

Efficient 

four-intensity 


0.551 

0.47 

Vl 

0.188 

0.183 

V2 

— 

0.32 

Pd 

0.127 

0.16 

P 

0.599 

0.407 

Pv2 

— 

0.22 

Pz 

0.669 

0.82 

R 

9.58 X 10“® 

1.53 X 10”® 


Pz\uj = Pz- The parameters {p,vi,V 2 ,Pp,,Pv^,Pv 2 ,Pz) 
are optimized to maximize the secret key rate. 

We set N to be 10® and compare the secret key rates 
of the efficient three-intensity protocol and our efficient 
four-intensity protocol. The results are shown in Fig. [T| 
Compared with the efficient three-intensity protocol, our 
protocol can increase secret key rate by at least 30% at all 
transmission distances. The increasing rates of secret key 
rate at different transmission distances are shown in Fig. 

|2| We can find that this increasing rate is monotonically 
increasing with the transmission distance. That is, the ad¬ 
vantage of our efficient four-intensity protocol is more sig¬ 
nificant at a large transmission distance. Particularly, at 
100 km, the increasing rate is 60% and the optimal param¬ 
eters and secret key rates are shown in Table Uj Addition¬ 
ally, we have also performed simulations with other sta¬ 
tistical fluctuation analyses, including the standard error 
analysis m and the Chernoff bound [sniisi], and obtain 
the same conclusion that the secret key rate is increased 
with our protocol and the improvement is more significant 
at a large transmission distance. 

Compared with the efficient three-intensity protocol, 
the secret key rate improvement of our efficient four-intensity 
protocol mainly comes from the following two aspects: 

(I) In efficient three-intensity protocol, the intensity vi 
in Z basis and the intensity V 2 in X basis are replaced by 
the same intensity v, and this intensity v participates in 
the calculations of both sz,i [Eq. (|1|)] and vx,i [Eq. ([5])]. 

In asymptotic setting, the optimal estimations of sz,i and 


























4 


Please give a shorter version with: \authorrunning and \titlerunning prior to \maketitle 



Fig. 1. (Color online) Secret key rate vs fiber length (ded¬ 
icated fiber). Numerically optimized secret key rates are ob¬ 
tained for a fixed number of pulses sent by Alice N = 10®. The 
optimal parameters at the transmission distance of 100 km 
are shown in Table [J] The blue dashed line shows the secret 
key rates of efficient three-intensity protocol ng. The secret 
key rates of efficient four-intensity protocol are presented by 
the red solid line. Compared with the efficient three-intensity 
protocol, our efficient four-intensity protocol can increase the 
secret key rate by at least 30%. Particularly, this improvement 
is more significant when the transmission distance is large. The 
increasing rates of secret key rate at different transmission dis¬ 
tances are shown in Fig. (2] 



Fig. 2. (Color online) The increasing rate of secret key rate vs 
fiber length (dedicated fiber). The red solid line shows the in¬ 
creasing rate of secret key rate between efficient four-intensity 
protocol and efficient three-intensity protocol. This increas¬ 
ing rate is monotonically increasing with the transmission dis¬ 
tance. 

Vx,i are obtained when the intensity v is infinitesimal m- 
Nonetheless, in finite-key setting, with statistical fluctua¬ 
tion [Eqs. (I3I7I) ] into consideration, the optimal intensity 
V, where the best estimation of sz,i is achieved, may not 
help to get a tight estimation of vx,i- Therefore, in our 
protocol, we make the intensities {vi and V 2 ) independent 
by adding another intensity. From Tabled the optimal in¬ 
tensity vi and the optimal intensity V 2 are, severally, 0.183 
and 0.32. They are quite different. In a word, the separate 



Fig. 3. (Color online) Optimal Pz vs fiber length (dedicated 
fiber). The blue dashed line shows the optimal Pzs of efficient 
three-intensity protocol M- The optimal Pzs of our efficient 
four-intensity protocol are shown by red solid line. From the 
results, we can see that our efficient four-intensity protocol al¬ 
ways has a higher Pz than the efficient three-intensity protocol. 

optimization of vi and V 2 helps to achieve a higher key 
rate. 

(II) Compared with standard balanced-basis protocol, 
efficient protocol can highly improve the secret key rate 
[igi^HlIMlI^ . In asymptotic setting, the increasing rate 
of secret key rate can reach 100%, when Pz approaches 1 
[25] . However, in finite-key setting, compared to standard 
three-intensity protocol with balanced basis choice, the ef¬ 
ficient three-intensity protocol can increase secret key rate 
by 45% [23]. As the transmission distance increases, the 
improvement of secret key rate will decrease. That is be¬ 
cause at a larger transmission distance, more pulses in X 
basis are needed to give an accurate estimation of vx,i in 
Eq. (0 and Bob has to increase Px ■ When Px approaches 
0.5, the efficient protocol becomes similar to the standard 
one, where Pz = Px = 0.5. In our protocol, we subtly 
add an additional intensity and make vi and V 2 indepen¬ 
dent. As Table [2] shows, we can increase the intensity V 2 to 
make the estimation of vx,i more accurate. That is, with 
an additional variable to reduce the statistical fluctuation, 
efficient four-intensity protocol can help to get a higher 
probability Pz to choose Z basis for key generation. The 
optimal PzS for these two protocols at different transmis¬ 
sion distances are shown in Fig. |3| From Fig. [S] one can 
see that for these two protocols the optimal PzS are all 
monotonically decreasing with the transmission distance. 
Nevertheless, the optimal Pz of our protocol is always 
larger than the one of efficient three-intensity protocol. 
This is the other important factor which leads to a higher 
secret key rate. 

Note that the intensity w of weakest decoy state in 
our simulations is set to be 2 x 10“"^ instead 0 (a vacuum 
state). That is because, in practice, it is usually difficult to 
create a perfect vacuum state in decoy-state QKD exper¬ 
iments [^1^ . although it is optimal to set the weakest 
decoy state to be vacuum state [H] . In Ref. m, Lim et al. 
choose the experiment parameter w = 2 x 10“"^ of Ref. m 
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Fig. 4. (Color online) Secret key rate vs the weakest decoy 
state Lj. The optimized secret key rates are obtained for dif¬ 
ferent transmission distances (20 km, 40 km, 60 km, 80 km, 
100km, from top to bottom). All the solid lines show the re¬ 
sults of our efficient four-intensity protocol, e.g., the black solid 
line shows the optimized secret key rates of our protocol for 
a fixed transmission distance 20 km. The results of efficient 
three-intensity protocol m are all presented in dashed lines. 
From these results, we find that as long as the intensity oj is 
below 1 X 10“®, the secret key rates of both the efficient three- 
intensity protocol and our efficient four-intensity protocol are 
stable, and our protocol has such an increasing rate of secret 
key rate as more than 30% in comparison with the efhcient 
three-intensity protocol at all transmission distances. 

to perform the numerical simulations. Following their sim¬ 
ulation work, we also set w = 2 x 10“^. However, what is 
the effect of the intensity of the weakest decoy state on the 
secret key rate? Here, we further optimize the secret key 
rate over the free w. The results are shown in Fig. We 
find that as long as the intensity w is below 1 x 10“^, the 
secret key rates of both the efficient three-intensity pro¬ 
tocol and our efficient four-intensity protocol are stable. 
That is, a perfect vacuum state is not essentially required 
in practical decoy-state QKD experiments. Meanwhile, we 
also find that even when the intensity u is free, our proto¬ 
col can still increase the secret key rate by more than 30% 
in comparison with the efficient three-intensity protocol 
in Ref. [Tl] at all transmission distances. 

5 Discussion and conclusion 

Actually, in terms of current finite-key analysis for decoy- 
state method, our idea that the intensities and the bases 
should be independent can be further exploited. Note that 
the intensity w also participates in the calculations of both 
sz,i in Z basis and vx.i in X basis, and we can add the 
fifth intensity to make the intensities (wi in Z basis and 
0 J 2 in X basis) in two bases independent. From Eq. ([5]), we 
can see that when the numbers of single-photon events in 
two bases are close, the sample deviation is small. Then 
the sixth intensity, e.g., with an average number of pho¬ 
tons of order 1 in X basis, is needed to make the numbers 


of single-photon events in two bases close. However, in 
practical implementations, setting more than four differ¬ 
ent intensities is hard for experimentalists. Our efficient 
four-intensity protocol is feasible and practical for current 
technology. 

In summary, we propose an efficient four-intensity pro¬ 
tocol and provide concise finite-key security bounds for 
this protocol that are valid against general attacks. Com¬ 
pared with the efficient three-intensity protocol, our effi¬ 
cient four-intensity protocol can increase secret key rate 
by at least 30%. Particularly, at a large transmission dis¬ 
tance, the improvement is more significant. 
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